[PATCH net] niu: bounds-check phy-type and model VPD strings

[PATCH net] niu: bounds-check phy-type and model VPD strings

[Akshay Ubale]

niu_get_of_props() copies the "phy-type" and "model" device-tree
properties into fixed-size np->vpd buffers with strcpy(), which does
not check the property length.

Use the length reported by of_get_property() to reject values that do
not fit, and copy with strscpy() so the destination is always
NUL-terminated.

Fixes: a3138df9f20e ("[NIU]: Add Sun Neptune ethernet driver.")
Fixes: f9af857489cc ("niu: Determine the # of ports from the card's VPD data")
Signed-off-by: Akshay Ubale <akshay.ubale001@gmail.com>
---
 drivers/net/ethernet/sun/niu.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 54dd7281191d..fab6af105df2 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -9260,7 +9260,7 @@ static int niu_get_of_props(struct niu *np)
 	else
 		dp = pci_device_to_OF_node(np->pdev);
 
-	phy_type = of_get_property(dp, "phy-type", NULL);
+	phy_type = of_get_property(dp, "phy-type", &prop_len);
 	if (!phy_type) {
 		netdev_err(dev, "%pOF: OF node lacks phy-type property\n", dp);
 		return -EINVAL;
@@ -9269,7 +9269,12 @@ static int niu_get_of_props(struct niu *np)
 	if (!strcmp(phy_type, "none"))
 		return -ENODEV;
 
-	strcpy(np->vpd.phy_type, phy_type);
+	if (prop_len > sizeof(np->vpd.phy_type)) {
+		netdev_err(dev, "%pOF: phy-type property too long (%d)\n",
+			   dp, prop_len);
+		return -EINVAL;
+	}
+	strscpy(np->vpd.phy_type, phy_type, sizeof(np->vpd.phy_type));
 
 	if (niu_phy_type_prop_decode(np, np->vpd.phy_type)) {
 		netdev_err(dev, "%pOF: Illegal phy string [%s]\n",
@@ -9294,10 +9299,15 @@ static int niu_get_of_props(struct niu *np)
 		return -EINVAL;
 	}
 
-	model = of_get_property(dp, "model", NULL);
-
-	if (model)
-		strcpy(np->vpd.model, model);
+	model = of_get_property(dp, "model", &prop_len);
+	if (model) {
+		if (prop_len > sizeof(np->vpd.model)) {
+			netdev_err(dev, "%pOF: model property too long (%d)\n",
+				   dp, prop_len);
+			return -EINVAL;
+		}
+		strscpy(np->vpd.model, model, sizeof(np->vpd.model));
+	}
 
 	if (of_property_read_bool(dp, "hot-swappable-phy")) {
 		np->flags |= (NIU_FLAGS_10G | NIU_FLAGS_FIBER |
-- 
2.53.0

Re: [PATCH net] niu: bounds-check phy-type and model VPD strings

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] niu: bounds-check phy-type and model VPD strings

[Jakub Kicinski]

On Wed, 21 Oct 2026 01:30:07 +0200 Akshay Ubale wrote:
> niu_get_of_props() copies the "phy-type" and "model" device-tree
> properties into fixed-size np->vpd buffers with strcpy(), which does
> not check the property length.
> 
> Use the length reported by of_get_property() to reject values that do
> not fit, and copy with strscpy() so the destination is always
> NUL-terminated.
> 
> Fixes: a3138df9f20e ("[NIU]: Add Sun Neptune ethernet driver.")
> Fixes: f9af857489cc ("niu: Determine the # of ports from the card's VPD data")
> Signed-off-by: Akshay Ubale <akshay.ubale001@gmail.com>

Please don't sent us low value patches like this during the merge window
When / if you repost make sure you add to the commit message the reply
to the questions asked by the sinfo bot.
-- 
pw-bot: cr